One email code, two simultaneous requests: which providers prevent double redemption?

Hi all,

I’m evaluating managed authentication while retaining Supabase for the database. Users should type an emailed one-time code rather than follow a magic link.

The requirement is at most one successful redemption of each issued proof, including overlapping submissions. For example, two simultaneous verification requests using the same issued OTP must not create two independent sessions.

This is not a one-session-per-user rule: later independently authorized sign-ins and multiple sessions are allowed. A safely authorized retry returning the proven original result is also different from a second redemption creating another independent session.

Does anyone have firsthand implementation experience or public provider documentation establishing this behaviour for Supabase Auth, Amazon Cognito, Clerk, Auth0, or another supported managed approach?

My current understanding is that generic “single-use” wording and rejection of sequential reuse do not, on their own, establish concurrency safety. Missing documentation is an evidence gap, not proof that a provider is defective. Please correct that understanding or point out any supported approaches I’ve overlooked.

Specifics about the authentication flow, required configuration, and whether the behaviour is supported and enabled in the managed service would be especially helpful.

Thanks!

Disclosure: AI assisted with the research and drafting of this question. I’m seeking firsthand human experience, corrections, and verifiable sources.